Zimbra Collaboration Suite PHP Remote File Inclusion (CVE-2025-68645)

Historical catalog analysis: CISA added this entry on January 22, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-68645 is a PHP Remote File Inclusion (RFI) vulnerability identified in the Synacor Zimbra Collaboration Suite (ZCS). The flaw allows a remote attacker to send specially crafted requests to the /h/rest endpoint. By influencing internal request dispatching, an attacker could include arbitrary files located within the WebRoot directory.

Exposure and applicability

This vulnerability applies to ZCS deployments where the /h/rest endpoint is accessible. Organizations utilizing ZCS as a primary collaboration or email platform should identify all instances of the suite to determine if they are exposed to this specific path. The risk is centered on the ability of an external actor to access files from the WebRoot directory that were not intended for public exposure.

Remediation priorities

Based on our analysis, vulnerability management teams should prioritize the following actions:

1. Asset Identification: Locate all ZCS instances and verify if the /h/rest endpoint is active and reachable from untrusted networks.
2. Vendor Mitigation Deployment: Apply the specific mitigations provided by Synacor. For cloud-based services, these actions should align with BOD 22-01 guidance where applicable.
3. Service Evaluation: In scenarios where vendor mitigations cannot be applied or are unavailable, evaluate the necessity of the service versus the risk of arbitrary file inclusion; if the risk exceeds the business utility, discontinue use of the product.

How to validate remediation

Verification must go beyond a simple version check, as software versions do not always guarantee that specific configurations or mitigations have been successfully applied. To verify that exposure has been reduced:

• Endpoint Testing: Use authorized security testing tools to attempt requests against the /h/rest endpoint to confirm that internal request dispatching can no longer be influenced to include arbitrary files.
• Configuration Audit: Review system logs and configuration files to ensure vendor-recommended mitigations are active and functioning as intended.

Successful validation is evidenced by the inability of a requester to retrieve unauthorized files from the WebRoot directory via the affected endpoint.

Limits and open questions

It remains unknown whether this vulnerability has been utilized in known ransomware campaigns. Furthermore, while vendor mitigations address the reported flaw, residual risk may exist if other endpoints share similar dispatching logic that has not yet been disclosed. Defenders should note that applying a patch or mitigation reduces the likelihood of exploitation but does not eliminate all risks associated with the underlying architecture of the WebRoot directory.

Source and editorial note

CVE-2025-68645: Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability · Source date: January 22, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: January 25, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 23, 2026 at 00:29 UTC.

Request a Vulnerability Assessment